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(54) nUe: REMOTE PROXY SYSTEM AND METHOD 



(57) Abstract 

An interface between a protected computer or computer 
networic (52) and the Worid Wide Web (WWW) (68). The 
interface comprises a split proxy system (56, 66) that encapsu- 
lates TCP/IP transmissions into a script transmission which is 
not subject to problems in high latency systems, thereby greatly 
improving WWW access, via a wireless modem or other low- 
bandwidth communications network. The split proxy interface 
(56, 66) also provides compression, encrypticm and filtering ca- 
pabilities and allows receipt of unsolicited transmissions from 
the service provider for such purposes as automatically updat- 
ing or configuring WWW access software. 
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Remote proxy system and method 



U.S. Patent Application Serial No. 08/309,336, 
filed on Saptsaber 19, 1994 by David Mathcv P*p*, Lisa 
B. Blit««r« Jaaaa Joa^ph BroGkaan, William Cruz, Dwi^ht: 
Omar EaXia, Miehaal Kraaar, Dawn Dian Patr, Josef a 
Kanaroson, Gerardo Baairas, Yang-Wai Wang, and Robart C. 
White, discloses siabjact aattar related to the present 
application and is hereby incorporated by reference. 

The present invention relates to an iiqproved 
interface between private coi^tera or private conputer 
networks and tlie World Wide Web (WWW) using both 
vireline and wireless connections. More specifically^ 
the invention relates to an i^roved WWW interface with 
protocol translation, security and autoutic configuring 
features. 

Descristion of tue moisted Xtt: 

For fifty years, people have dreaaed of a universal 
inf oznation databasa - data that would net only be 
accessible to people around the %rorld, but organized 
such that related inforaation is easily discovered and 
so that the aost relevant data for a particular need is 
quickly found and accessed by a user. 

In the I960's, this idea was explored further, 
giving rise to visions of a •'doeuverse" that would 
revolutionize all a^ects of huaan<-inf oraation 
interaction, particularly in the educational field, 
oiay recently has the technology started to fxilf ill 

visions. Baking it possible to iapleaant thea on a 
global scale. 
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TKe Zn^Mm^^ bas evoXvad tJirougtx a coopajra^lv^ 
af^oart toy unlvarsl^lM, corporations and 9ov«mmftn*b. 
Yaaz-s ago, ^o l>e£anM Departoaant vtartad 
intierconnacelng ^a coaputar natvorica at unlvoraltlaa, 
5 private organizations and aomatimas corporations vltl% 
wtiom research was being conducted. Ttxis network or 
networks lias, over tine, evolved into a global network 
coiamonly referred to as tbe Internet or tbe World Wide 
Web (WWW) • Tbe omcial description f or* tbe www is a 
10 •*wide«area bypenacMiia inforaation retrieval Initiative 
aiming to give universal access to a large universe o£ 
docxxments. 

Am tbe www became more popular and s\ibjeet to wider 
public uae, tbe Department of Defense curtailed its 

X5 involvement* Today, many government-fuzxded links on tbe 
Xnternet nave been turned over to commercial enterprises 
tbat maintain tbe interconnection o£ lAcal Area Networks 
(UUIs) between universities, companies, etc. 

Tbougb tbe WWW is proving to be an extremely 

20 valuable resource for corporate enterprises (for 

communicating via electronic mail (e-mail) , accessing 
information on-line, etc.), corporations are concerned 
about tbe secuarity of tbeix^ intellectual property, trade 
aacrets, financial records and otber confidential 

25 information stored on tbeir coiq^uter networks. Tbere is 
also concern about electronic vandalism — unautborized 
access of a computer network over tbe www fox* tbe 
purpoee of destroying or distorting computerised 
Information • 

30 Tn response to tbese c o n ce r ns , some connections to 

tbe WWW bave been protected with -Network Security 
Firewalls.** as sbown in Fig. 1, a firewall is commonly 
a specific piece of Hardware and/ or software bridging 
tbe connection between a private computer or computer 

35 network (LAH) XO and tbe WWW la. Thm main purpose of a 
firewall is to screen data traffic into and out of tbe 
network tbat is to be protected. Zf a network intruder 



wo 97/35402 PCTAJS96/03909 

±6 det:ec^ftd, tilia firewall lias th^ capability of sifting 

through the data traffic and disabling the intruder^ a 

accass* In early forms of Internet firewalls, it was 

generally difficult to aaeertain which data traffic was 

5 good or bad, i«e*, relating to a corporate user or an 

intruder. This created a problem for corporate users 

(inside the corporate UM) of Internet applications, 

such as File Transfer Protocol (FTP) , because their 

applications would sometimes get incorrectly blocJced by 

10 the firewall. The firewalls needed more intelligence 
about application data traversing a firewall so that 
desirable traffic was not hindered. 

Internet engineers designed "proscy** services on 
Internet firewalls to meet this need* These proxies are 

15 computer processes that completely understand specific 
applications like an FTP application. It became a 
stra^ightf orward matter for network administrators to add 
multiple proxies to the firewall system based on the 
type of applications the internal corporate users wanted 

20 to execute. For example, WWff browsers (described below) 
would use a Hyper Text Transport Protocol (HTTP) proxy 
to transfer Hyper Text Markup lAngiiage (HTML) documents. 

To facilitate use of the WWW, ''browsing** software 6 
was developed. Browsers, such as the popular Netscape*** 

25 and Mosaic*" browsers, allow WWW users to browse 

infoinnation available on coa^uters linked to the www. a 
related invention by the assignee, described in tr.s. 
Patent Application Serial No. 08/309,336 (hereinafter 
**the ^336 application), provides users on computer 

30 networks with a consistent means to access a variety of 
media in a sinqplified fashion. Ma}cing use of browsing 
software, the invention of the '336 application has 
changed the way people view and create information - it 
has created the first true global hypermedia network. 
35 One responsibility of an HTTP proxy is to receive 

requests from browsers or software applications 6 within 
tne protected network lo and relay those requests to the 
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WWW 12. rmm proxy also moniters access ^o tihe prot:ect;ed 

compulier or network 10 from the WWW 12. Thus, the proxy 

4 con allow a aystem administrator to monitor 

Inrormation and requests Cloving between the protected 

5 networx xo and the www 12. If illicit activity is 

discovered, the proxy 4 can interrupt the connection to 

the WWW 12* This proxy^-driven firewall 2, 4 allows 

corporations and those with similar concerns to make use 

of the valuable resources of the WWW 12 while 

10 maintaining a degree of security. 

To effect links between computers and software 
applications across the WWW, protocols have been 
developed to govern the transmission of conqputerized 
data. A protocol organizes data to be transmitted over 

IS the WWW in a standard way recognizable by the receiving 
coiqputer. There are seven layers in the open systems 
interconnection (OSZ) model of a coaqputer protocol « 
£ach layer adds additional organizational capabilities 
that facilitate the transmission of data. 

20 Internet Protocol (IP) is the third layer in the 

OSI model and the basic ** language^ that is spoken on the 
Internet. The fourth layer. Transmission Control 
Protocol (TCP) , is a more specialized protocol contained 
in IP. TO use the WWW, a computer must be able to 

25 communicate using a protocol that incorporates IP and, 
consequently , TCP • 

The WWW and technologies surrounding Internet 
access have seen cuqplosive growth. Kany companies have 
evolved to allow subscribers access to the WWW using 

30 standard telephony* A group called Internet service 
Providers (ISP) represcmts many of these service 
providers . 

A promising area for further escpansion of Internet 
access is wide-area wireless data networ)cs. The 
35 wireless networks include cellular digital packet data 
(COPD, provided by cellular carriers), circuit-switched 
cellular networks, such as the Mobitex™ network 
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(provided by RAM Mobile data in the U.S.) , the Ardis™ 
netvorX, and a host of emerging national wireless data 
providers* 

All or the listed data network providers orrer 
5 traditional Internet Protocol (IP) service and are 

capable of integrating with the www. The data speeds 
range from 4,800 to 28,8000 bps and have latencies that 
range from xailliseconds to 10 seconds. 

Despite the popularity of the WWW, there are still 
10 technical and security issues that must be overcome in 
accessing the Xnteme^. some of these problems are 
particularly acute for wireless systems trying to access 
the www, 

15 Prg^>l«B 1 

The first problem is caused by data latency 
(described in more detail below) . Data latency refers 
to the time delays created by multiple hops and slow 
links as data travels across various nodes within the 
20 WWW. This particular problem is exacerbated when the 

www is accessed iising a wireless modem. Most wide area 
wireless, and some wireline, data networks were not 
originally designed to support the TCP/IP protocol. 
Latencies are increased even further by encapsulating ZP 
25 data into the networks^ original data protocols. 

When TCP is organising data for transmission over 
the WWW, it breaks the data into discrete ""packets" of 
information. TCP then transmits the individual packets. 
Each packet includes instructions to the receiving 
30 system for reassembling the packets into the complete 
data structure being transmitted. Bach packet also 
includes a cyclic redundemcy check that allows the 
receiving system to check tha^ the packet was not 
corrupted or broken up during transmission. 
35 TCP is typically configured to transmit a number of 

packets and then wait for a confirmation from the 
receiving system that the packets have been received 
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properly* Tha amoun't ^ime required i:ransial^ a 
da^ packat: and raeaive confirmation of its anrival is 
known as t:he ^'latsncy** of thm system • 

If TCP does not receive confirmation that the data 
5 packet was proper ly received/ it will assume that the 

packet was lost during transmission and re-transmit the 
packet. If the latancy of the systom gets too high, TCP 
will assume, prematurely / that the packet was lost and 
flood the network with re^transmissions of the same data 

10 packets before the original packets reach their 

dsstination. This is also a problem because many 
service providars charga usars per data packet 
transmitted* If TCP is flooding the system with 
unnecessary duplicates of packets still in transmission, 

15 the cost to tha user will be greatly increased. Thtxs, 
TCP cannot oparata properly over a connaetlon with a 
high latency. If the latancy of the system exceeds 
approximately 3 to 5 seconds, TCP will begin to 
malfunction. 

20 When the WWW is accessed ov«ur standard phone lines 

that do not support TCP, tha TCP datagram must be 
encaps\xlated (i.e., trans latad) into a form that can be 
sent over the telephone line. The datagram is than 
unpacked and used by the receiving cos^uter. While this 

25 approach works, it adds to the latency of the 
transmission • 

A further problam with accessing using a 

wireless modem is the increased latencies that are 
introduced by the wireless network. A general trend is 

30 the wider the area served by a wireless data network, 
the lower the bandwidth (in bps) of the transmission. 
For eaea^le, present wireless communication systems in 
use in the United states are capable of transmitting 
4,800 bits of data per second. This results in 

35 latencies up to as much as 10 seconds. 

Related art on wireless WWW access exists at: 1. 
Carnegie Mellon Uhiversity's Information Networking 
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Institute, wir«les3 Andrew Initiative. 2. Rutgers 
University's Winlab, Dataman project. 3. University of 
Wasnington's CS«E, Mobisaic. 4. Xerox's Palo Alto 
Researeb Center, PDA and virtual office co^niting 
5 concepts. 5. Computer Networlcs & ISDN Systems Volume 
0O28, Number 1-2 ISSN : 0169-7552 , Dec '95, "PDAs as 
Hobile WWW Browsers", Gessler S., Kotulla A. 6. General 
Magic's, Magicap OS version of a WWW browser with 
enhancements for Telescript agent technology. 

f^lji of these projects and papers either require the 
modification of a browser, specification of new 
protocols (still based on TCP) , or defining generic 
inter-networking specifications for connecting wireless 
and low-bandwidth networlcs to the Internet for www 

15 access. 

Thus, there is a need for a method of translating 
TCP in connections over high-latency wireless and 
wireline networks. 

20 FrP**"'*" ^ 

A second problem is that current www access 
software does not provide standard mechanisms for 
compression, encryption, or filtering, compression 
entails decreasing the size of transmissions of data 

25 over the network without changing the content of the 
information. Most proposals for compression support 
require external utilities from the browser to 
decoaqpress the data, and then return usable output to 
the browser through the use of Multipurpose internet 

30 Mail Extension (MM, Nathanial Borenstein et. al RPC 
1521) types. 

Encryption is the coding of data transmissions. 
Encryption helps to provide sacsurity einca anerypted 
data tranamissiono are much more dif fietxlt for an 
35 unauthorized party to intercept and access. 

Unfortunately, it is unlikely that generic, open 
standards for these desirable services could be created 
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t:o support all WWW client recpMSts. Standards are 
avolving for encryption In WWW software (l«a*. Secure 
Socket Layer (SSL)). However, at current levels of 
computer hac)ciJig, it is \inli)cely tliat any open standard 
5 for encryption will be able to maintain integrity for 
long* 

Most advanced browsing technologies, therefore^ 
have installed proprietary encryption schemes and are 
only capable of working between a www sezrver that 

10 supports the encryption schexoe* This option goes 
against the open standards design of the www. 

Flitting rafars to global control of a WWW 
response based on data sisa, ^ype, or some other 
characteristic whereby a user can customise the receipt 

15 of data. Work is being done in this area through WWW 
search anginas, specialized caching utilities on 
advanced browsers, etc* 

The filtering referred to here is a global safety 
net for unwary users that could potentially misuse a 

20 wireless/ low-bandwidth data network by requesting t^oo 
much data, retrieving spurious information, or some 
other unwanted side effect resulting from a www reques't. 
For example, a user may request a date object from the 
WWW that a user is not aware is extremely large, and 

25 perhaps costly, to transmit. As a safety net, the user 
may conf igura a filter to automatically prevent; a 
particular request from being executed* 

Thus, there is a need for an implementation of 
compression, encryption and filtering features in a WWW 

30 interface* 



Problem 3 

A third problem exists in that thare is no standard 
way for WWW access software/to receive asynchronous or 
35 unsolicited updates from the network. Existing browser 
technology is client based. The most popular browsers, 
such as the Netscape", Mosaic^, LynxT browsers, as well 
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as o-thor Immu popular brovsars, require users 

initial:* sose form at raquMt befor* response datui will 

be delivered t:o ^e respective browser. 

For exaaple, it is desirable £or a company 
5 providing access to tbe WWW to be able to remotely 

configure a subscriber's WWW access system from vitbin 
the network. Sine* regular browsers do not offer this 
feature, subscribers must configure and update their 
access software manually. This may require the support 

10 of the service provider through a traditional voice 

customer suppozrt line or custom agent software on the 
user's host system (refer to ""ISC: Integrated Services 
Gateway", Bellcors TM-*24856, for a more complete 
— description of the problem) . 

15 Thus, there is a need for a WWW interface that can 

receive and implement unsolicited transmissions from the 
network or service provider, particularly to 
automatically configure software for accessing the 
network* 

20 

smtwaav aw yKB fiiVfiimrQW 

It is thixs an object of the present invention to 
meet the above^escribed needs and others. It is an 
object of the present invention to provide a method and 

25 system for interfacing with the WWW that supports TCP/IP 
in a high*-^latency environment, provides compression, 
encryption and filtering services and accepts and 
implements unsolicited messages from the WWW or the 
service provider. 

30 Additional objects, advantages and novel features 

of the invention will be set forth in the description 
that follows, and will become apparent to those skilled 
in the art upon reading this description or practicing 
the invention. The objects and advantages of the 
35 invention may be realized and attained by the appended 
claims. 
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To achieve rore90ing and o^ajr objects and In 

accordance vi'th tihe purpose of ttim present: Inventiion, as 
embodied and broadly described herein, the system and 
method of the present invention may utilize a host 
5 cooMputer having a browser and a local proxy in a first 
location, a remote proxy in a second location in 
communication with the local proxy throixgh a low- 
bandwidth network, means for initiating a query on the 
browser and sending the query to the local proxy using 

10 an application layer protocol, means for converting the 
application layer protocol of the query into a transport 
protocol suitable for transmission over the low- 
bandwidth network, means for transmitt:ing the query over 
the low-bandwidth network from the local proxy to the 

15 remote proxy, and means for converting the transport 

protocol into an application layer protocol suitable for 
execution of the query on the comput^er network. 

It is also preferred that the system and method of 
the present: invention include means for communicating 

20 the query to a network server, executizig ttim query* and 
returning a data object to the remote proxy, means for 
converting the data object into a transport protocol 
sui^table for transmission over the low-bandwidth 
network, means for transmitting tOie datui object over the 

25 low-bandwid1:h network from the remoi:e proxy to t:he local 
proxy, means for converting the transport protocol of 
tJie data object into an application layer protocol at 
the local proxy, and means for communicating the data 
object into the browser using the application layer 

30 protocol* 

It is also preferred that the system and metihod of 
the preseni: invention include means for creating a query 
script havixig settings for compression, filtering, and 
encryption, means for encapsulating the qpiery script for 

35 transmission over the low-bandwidth network from the 

local proxy to the remote proxy, means for compressing, 
filtering, and encrypting the data object according to 
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stt^Hings in the (luery script, and means for placing 
cLatia object: in a reply script for transmission over 

tlie low->bandwidt)i network from tne remote proxy to tlie 

local proxy. 

5 In a further aspect of the present Invention, in 

accordance with its objects and purposes, the system of 
the present invention may also comprise a system for 
commxmicating with a computer network^ comprising a host 
computer having a browser for a user interface, a local 

10 proxy means for communicating with the browser using an 
application layer protocol, the local proxy means having 
meams for converging the application layer protocol into 
a transport protocol, and a remote proxy means for 
communicating with the local proxy means using the 

15 transport protocol. The remote proxy means includes 
means for converting the transport protocol into the 
application layer protocol, and means for commimicating 
with the computer network using the application layer 
protocol • 

20 

mgy DgscmiPTicM 09 m Dttxwnfoa 

The present Invention will become more clearly 
appreciated as the disclosure of the present invention 
is made with reference to the accompanying drawings, 
25 wherein: 

Fig. 1 is a block diagram showing the related art 
firewall interface between a private convuter network 
and the www. 

Fig. 2 is a block diagram showing the split proxy 
30 interface of the present invention* 

Fig. 3 is a schematic diagram of the protocol 
translation performed by the local proxy interface of 
tJie present invention. 

Fig. 4 is a schematic diagram of the protocol 
35 translation performed by the remote proxy interface of 
the present invention. 
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Pig. 5 is a flow chairt shoving thm implementation 
ot the proxy interface ot the prMant invention. 



ngPXTT.m PgSCRTPTIOH oy THH gRgyKBBTO PffBQnTMTWT 
5 Reference will now be made in detail to a preferred 

enhodiment of the invention, an example of which is 
illustrated in the accos^anying drawings. 

The creation of the WWW is a computing revolution 
\i^ich also offers a potential catalyst for wireless data 

10 nstwor)cs to become a direct participant in exploding 

Internet popularity. The present invention provides a 
method and system for interfacing a private computer or 
private computer network with the WWW %rhlch provides 
support for TCP/IP in a high-latency environment; 

15 compression, encryption ^ and filtering services; and the 
receipt and implementation of unsolicited messages 
transmitted by the service provider. The present 
invention also allows a Laptop or Personal Digital 
Assistant (PDA) direct access to the WWW from a mobile 

20 (wireless) terminal. 

For example, the interface to the WWW of the 
present invention may be implemented by modifying a 
proxy « Fig. l# element 4, to perform the required 
f\inctions. The modified proxy would become a system of 

25 split proxies (sometimes referred to as Agent 

technology, as described in U.S. implication Serial No. 
08/309,336) that could be inqplemented on a firewall^ or 
can be an application running in the badcground on an 
individual computer r even a laptop, that can access the 

30 WWW via a wireless or wireline network. 

Referring to Figozre 2, the interface of the present 
invention is a modified split proxy* A split proxy 
comprises a local proxy 56 and a rfamote proxy 66, which 
are software modules that enable translation and 

35 restoration of www requests. 

A user operating a mobile terminal 52 is using a 
web browser 54 which communicates with the www using 
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TCP/IP. Ths local proxy 56 is a soft:wara package that 
runs In the bac)cground on the user terminal 52* Where 
high latency is a problea, the local proxy 56, according 
to the principles of the present invention, will 
5 translate data recjuests/ transmissions between the TCP/IP 
protocol used by the browser and a protocol robust 
enough to carry data across the communication network to 
the remote proxy. 

In the illustrated embodiment of Figure 2, the user 

10 is accessing the WWW through a wireless network. For 
example, a wireless modem 58 uses a low-bandwidth 
optimized protocol, such as AirBoss*" Wireless Transport 
Protocol, to communicate with base station 60* Thus, 
_the local proxy 56 translates the low**bandwidth 

15 optimized protocol to TCP/IP. 

The local proxy's encapsulated request, script (see 
Fig. 5 - General Browser Usage Flow) , is transmitted 
through a wireless network 62 to the remote proxy 66. 
The remote proxy 66 makes the necessary protocol 

20 translations between TCP/IP and the low-bandwidth 

optdLmized prot.ocol, sucsh as AirBoss** Wireless Transport 
Protocol, to connect the user to the WWW sa. 

The present invention provides several methods by 
which standard web browsers that support proxy services 

25 can be adapted for wireless and low-bandwidth wab 

browsing. The present invention will be explained by 
describing three sets of methods, which relate to the 
first, second, and third problems described above, 
respectively • 

30 

The first problem to be overcome is the 
transmission of data using TCP/IP over networks that 
experience high latency, for example, more than 
35 approximately 3 to 5 seconds. The method and system 
\ised to solve Problem 1 involve protocol translation. 
Protocol translation refers to encapsulating TCP 
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application reques-cs that taav« a singl* r*qpi*st/raspon8a 
pair (i.*., HTTP, SMTP, Sophar, and VMS) into a 
suitable connection-oriented protocol robust enougb to 
function in the high latanciaa encountared over 
5 coaimunication networks, particularly wireless and other 
low-bandwidth networks, that transmit the data. 

The protocol translation is achieved by the split 
proxy. The local proxy is started on the host where a 
\iser also initiates a standard web browser. The web 

10 browser is configured, either by the user or the local 
proxy, to coBBBunicate with the local proxy. The latter 
configxxration option is preferred because it hides 
reasonably sophisticated proxy configuration issues from 
the user. However, the proxy must know which browser is 

15 being used. 

Once the local proxy and web browser are launched 
and configxired correctly, the browser then funnels all 
WWW requests through the local proxy. The local proxy 
then takes the browser's WWW request and converts it 

20 into an appropriate low-bandwidth optimised protocol for 
the network being used (e.g. , AlrBoss" wireless 
Transport Protocol, based on UDP/IP) . 

The remote proxy is capable of receiving the 
converted script form from the local prosqr »nd 

25 completing the operation on behalf of the original 

request made by the browser. Once the data is received 
at the remote proxy from the converted request, the data 
is encrypted, compressed, filtered based on the original 
script, and/ or encapsulated into an optimized protocol 

30 and sent back to the local proxy (these services will be 
described in more detail in Kethods 2 & 3 described 
belov) . The local proxy receives the encapsulated 
response, unpaokagos it, and returns the final rospense 
to the browser. 

35 Referring to Figure 3, the exaaqple of a request Cor 

WWW data will be described. The web browser 54 outputs 
a request which is couched in the advanced OSI protocol 
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layers or application layer protocols 70 wnich comprise 
TCP/IP. Ttxm request is transmitted to the local proxy 
56 vlilch translates the request into a lov-bandvidth 
optimized protocol 72, such as AirBoss^ Wireless 
5 Transport Protocol, which is based on UDP/rp. The 

encapsulated request is then submitted via the netvorJc 
access device 58 (e.g., modem) to the low--bandwidth 
network. 

Referring to Figure 4, the request traverses the 
10 lov-bemdwidth network to arrive at the generic service 
node 74. The encapsulated request is then sxibmitted to 
the remote proxy 66 lAich translates the encapsulated 
request from the low-bandwidth optimized protocol (e.g., 
AirBoss~ Transport Protocol) to the application layer 
15 protocols originally created by the web browser, and 
submits the browser's request to the Internet* 

. Regarding the communication between the remote and 
local proxies, multi-threading is important. 
Hulti-threading refers to a programming/operating system 
20 paradigm that allows applications to appear to do 

several operations at the same time. During development 
of the present invention, it was discovered that the 
split proxy should be capable of multi^threading 
request /response pairs. Since most WWW browsers support 
25 multi-threaded client request/responses, the split proxy 
should do the same to facilitate seamless integration 
into the WWW access regime. 

Implementing multi-threading in the split proxy of 
the present invention requires a transaction systam 
30 between the local and remote proxies to match the 

internal scripts that encapsulate a request with the 
response scripts destined for a browser. The precise 
transaction system implemented betwecm the proxies is 
not important, and it will be obvious to one of ordinary 
skill in the art how such a transaction system may be 
structured based on the disclosure of the present 
invention. The protocol and transaction mechanism 
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described in Method Setis 1 and 2 is based on tHe 
Personal commxinications Internet work (PCI) system 
described in tbe '336 application* 

The more sophisticated the transaction system, the 
5 better the system and method ot the present invention 
becomes for enabling end-users to browse the WWW over 
low-bandvidth networks. The following methods of the 
present invention are based on this discovery. 
A benefit of supporting multi-threaded 
10 request/response pairs is that multiple browsers can be 
supported on a host by a single local proxy. 



As the WWW developed and the existing protocols 
15 were layered on top of each other to meet the data 

transmission needs of \isers, web browsers were created 
to make use of the exiting protocols. Xn current WWW 
access software, the need for data security and 
compactness was largely overlooked. As a result, web 
20 browsers using TCP/IP do not provide for encryption, 
compression or filtering of data for transmission. 

The main consortiiam for the WWW, W3C, has 
considered standards for securing transmission of data 
over the WWW. However, the problem with such web-wide 
25 standards is that, once they are announced, hackers 
begin to work their way through the protocol 
specification to find ways of defeating the sec\irity 
measures . 

Accordingly « it is an object of the present 
30 invention that the proxy software include congress ion, 
encryption, and filtering tools in a proprietary regime 
that still makes use of all of the opcm nature of the 
www. Thus, the transaction system between the remote 
and local proxies, including compression and encryption 
35 algorithms, may be a proprietary system devised by a 
service provider for the use of its customers. 



- 17 - 

WO 97/35402 PCT/US96/03909 
A filtering t:ool can also ba inqploien^ed by 1:he 

split^ proacy. Fil^aring, in Uie con^aaet of ^he presMt: 

Invention, refers a global conteol on tiim low- 

bandvid^ ne^worJc. For example, when browsers subni^ a 

5 request for information, they generally do not know how 

much information is going to be retrieved. According to 

the principles of the present invention, the local proxy 

receives filtering configuration instructions from the 

user which are then transmitted to and implemented by 

10 the remote proxy. The remote proxy can then perform 
such functions as examining the response to a user's 
data request and stopping unduly large data objects, for 
example, from overwhelming the user's system. 
_ In general, encryption and coxqpression algorithms 

15 are better placed in between the local proxy and the 

remote proxy as opposed to placing such capabilities in 
a new web browser* As noted, such algorithms can then 
be protected in a proprietary regime. One of ordinary 
skill in the art could easily design encryption and 

20 coB^ression algorithms based on well-^known principles 
for any service provider desiring a unique set of 
algorithms. 

on the other hand, despite their vulnerability, 
open, widely**known standards for such algorithms, such 
25 as have been considered by the W3C, have advantages, 
such as, for example, interoperability. 
Xnteroperabllity allo%rs different producers of proxies 
to make remote and local proxies that function together. 
This also allov manufactxirers of different computer 
30 platforms to bridge their platformis with others. 

A script to implement compression, encryption and 
filtering, whether proprietary or open, should include 
fields to do at least the following: 

A. Support encryption. For example, MD9 cipher 
35 algorithms for secure monetary transactions of 
electronic data. 
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B* Support mullilple types of compression 

(compression choice should be based on the type of data 

contained in the script) • For example, LZW compression 

algorithms can be used on textual data. 

5 C. Support at least negative filters or positive 

filters. For example/ one or more of the following 

filtering algorithms can be used: 

Negative filters - A response script should 

not include any binary data or a response 

script should not be greater than this size. 

Positive Filters * A response should inclxide 

all lines of text with "vireless** in it. 

If at any point along the path between the remote 

and local proxies there is some failure, particularly in 

the wireless environment, the transaction system between 

the local and r^ote proxies must be able to respond 

appropriately* For example, if the script cannot be 

submitted to the wireless network, or the script fails 

to get to the remote proxy, or the remote proxy is 

incapable of getting access to the Internet, the 

transaction system must respond appropriately. 
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The final problem arises because WWW access 
25 software, the web browser, was originally designed to 
act as a client. Client software on its own generally 
is not capable of receiving asynchronous or tansolicited 
updates from the network. This is a problem if a 
service provider would like to provide subscribers with 
30 access software and then to remotely (from within the 
network) manage the configuration of that software for 
the user. This featxire of the present invention 
provides a %ray for large service providers to offer WWW 
access that is scalable to the needs of the customer. 
35 * As noted, the web browsers currently in use are not 

designed to receive and implement such updates. The 
service provider may instead distribute new updated 
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software. If tiim. user is operating on a large scale, 
ixE^lesienting an update may even require a service 
technician dispat^died to reins'tall the software, 
reconfigure the 6oft%rare/ and troubleshoot it.. 
5 Alternatively, the eustoaer may have to call a customer 
support line and wait for verbal instructions to support 
installation of the update. 

According to the principles of the present 
invention, a sis^ler and more efficient solution is 

10 provided by a service provider using the spli't proxy 

interface. Using the encryption and security protocols 
designed for the service provider's system, the service 
provider can access the user^s WWW access software on 
the user's own system and immediately install, configure 

15 or update that software. This method may also 

incorporate messages to the user to indicate the action 
taJcen by the service provider. 

Hie solution of the present invention is to 
configure the local proxy to be capable of 

20 asynchronous/unsolicited receipt of scripts that are 

designed to modify an end user's host system for things 
like software updates, configuration changes, or new 
service advertisements. Ideally, the local proxy should 
be running constantly in the background of the user's 

25 system to receive and implement such eommunxca'tions, 
even if the web browsing software is not ruxming. 

Since the local proxy is not part of the browser 
and should always be running to receive these 
asynchronous network uploads, the present invention was 

30 designed ^o be small and modular to limit the amount of 
system resources. This feature protects against 
unwanted interaction with other installed software 
(i.e., memory allocation, IP port assignment, etc.). 



35 



Pregerrad Imltamtation 

Referring to Pig. 5 of the drawings, a flow diagram 
of the present invention will be described. The flow 
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diagram of Pig* 5 has a aeries of en^it:ies listed at; titm 
top corresponding ^o ^he main components of the present 
invention, including the weh browser 54, the local proxy 
56, the remote proxy 66, and the external veb server of 
5 the WWW 68. The flow diagram illustrates the 

interaction of these coiq[>onents during the startup 
process, the general browser usage process, and the 
service update process, respectively. 

The web browser 54 and the local proxy 56 are 

10 designed to run co-resident on the same host computer or 
user terminal 52. The remote proxy 66 and the external 
web server, however, do not necessarily need to be co^ 
resident. The remote proxy 66 must only be able to 
access and communicate with the external web server* 

15 The arrows in Pig* 5 represent communication or 

transfer of data from one entity to another. The aorrow 
heads specify the direction in which the action is 
directed. The lines from top to bottom represent the 
timeline and the sequence with which the process steps 

20 occur. 

The first flow shown in Fig. 5 is the start-up 
flow. This is basically how the system is activated on 
the end user's host computer. It is assumed that the 
remote proxy and the external web server are already 

25 running in all of these flow descriptions (those systems 
can be maintained and started by a system administrator 
with no interaction from the end user's point of view) . 
The first action that occurs is that the end user starts 
the local proxy. That simply means launching an 

30 application that starts up and runs in the background of 
a multi«threaded operating system. The operatdLng system 
can be, for example, the Windows™ Version 3.1 operating 
system. 

After the local proxy is started, the local proxy 
35 has two responsibilities. If the browser typs is 

specified on the user's host computer, the local proxy 
should configure and start the browser. Some browsers 
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mus^ configured before they are launctied, vtiile ot:her 
browsers must be launcbed first and then configxired. 
This is dependent on ^ich browser type is being used. 
The browser can be any conventional browser type that 
5 supports proxy services « 

If the browser type is not known, the end user will 
have to launch and configure the browser manually for 
the local proaey. in this case, the end user must know 
enough information about the web browser that he is 
10 using to be able to manually configure it for proxy 
services. 

The second flow shown on Fig. 5 is a general 
browser usage flow. This flow shows the process steps 
of the present invention after the browser has been 

15 started and configured. The end user first siibmits a 
standard web request. That basically means the user 
points and clicks on a hyperlink or opens up a dialog 
box and enters what is typically called a universal 
resoxirce locator (URL) . For example, this is how the 

20 Internet community identifies and accesses data objects 
on the www. 

The next st^ in the flow for the general browser 
usage is that the query laxuiched from the browser is 

submitted to the local proxy. The local proxy creates a 
25 query script, and places settings in that script 

defining the type of compression to be used on the data 

object or the types of coaqcuressions that are available. 

The local proxy also places settings in the scnript for 

the filters and the encryption type to be applied to 
30 that data object. The settings provide security axid 

also give the user control of the information that will 

be returned in response to the query. 

After that script is created, it is delivered to 

the remote proxy. The remote proxy parses the query 
35 script and extracts the packaged query that was 

originally submitted by the browser. The remote proxy 
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then executes tha query in a standard web data object 

request. 

The eactemal web eerver, after receiving the query, 
will return the appropriate data object associated with 
5 the query. No other special enhancements are needed at 
that point* That is just a traditional client to server 
request on the computer network that can use any 
appropriate WWW protocols* For example, hypertext 
transfer protocol, file transport protocol, simple mail 

10 transport protocol, or post office protocol can be used* 
After the data object has been returned to the 
remote proxy, the remote proxy applies the compression, 
filters, and encryption that were specified in the 
original query script. Those include the actions to be 

15 run on the data object to put the data object into the 
co rrect form for delivery to the local proxy. The 
compression, filters, and encryption are formulated into 
a reply script* 

After the actions are coiq>leted and delivered to 

20 the local proxy, the local proxy matches the reply 

script with the request script* Once the reply script 
is matched with the request script, it will know the 
appropriate browser and place to deliver that 
information to the browser. The local proxy then parses 

25 through the reply script and extracts the internal data 
object. Thus, two things need to happen with the reply 
script in the local proxy. The reply script must be 
matched with the request, and the local proxy must 
extract the data object out and deliver it to the 

30 appropriate place in the operating system so that the 
browser can display the object in its viewer • 

The third flow sho%m in Fig. 5 la a service update 
or a service script flow. This is a situation where a 
network administrator that is interested in implementing 

35 updated services would be able to remotely from within 
the network configure an end user's host system. The 
remote proxy creates a service script « For example, if 
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a nev HTML home page is b« delivered and configured 
on the end user's rezoote systea, a service scx^ipt: would 
be created that instructs the local proxy to write an 
HTML file into the distribution. The service script 
5 would contain the UZML page as the data object and once 
the script is completed in an appropriate forsir i^ would 
be delivered to the local proxy. 

The local proxy has a responsibility of parsing 
through the service script, pulling out both the action 

10 and any associated data objects with that action, and 
completing the requested action. So, to finish the 
example, the local proxy would parse through to find out 
what action was requested (writing a new HTML home 
page) , extract the data object (a new HTML home page) , 

15 and then write the data object to the local file 

aietribution. The arrow indicates that it is sometimes 
appropriate to display information into the browser. 
Sometimes that is not going to be possible, and the 
local proxy will display dialog boxes or other user 

20 interface notification of appropriate actions. The 
browsers that are capable of receiving asynchronous 
updates can be notified at that point, and the local 
proxy will initiate that action and send any appropriate 
user interfacse controls to the browser to display to the 

25 user the actions that have just been executed on the 
local host system. 

The interface between a user and the wm provided 
by the present invention provides protocol translation, 
concession, encryption, filtering and automatic service 

30 updates that results in a much improved connection to 
this extremely valuable resource. Regarding 
compression, there could be a direct savings to an cuid 
user for demanding the proxy services of the present 
invention in a wireless networking environment. Most 

35 wireless network providers have per packet charges or 

flat rates for bulk usage (e.g., fixed rate for up to X 
MB of data) . A direct savings could be realized when 
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da^a on tlia^ link is con^rassed* Smplrical meafturamen^s 

show ^al: standard HTML data can be regularly compressed 

^o 50*^60% of tihe original payload, including script 

overhead. This means a customer can retrieve twice as 

5 much WWW data for the same price. 

The present invention provides a way for a network 

administrator to directly manage a customer's host 

configuration # foregoing less reliable technical suppoxrt 

lines to troubleshoot problems or requiring the customer 

10 to learn sophisticated settings for software. Also, new 

service deployment is automated by the present 

invention. 

The technology embodied in the present Invention is 
most suitable for use by ISPs, manufacturers of PDAs and 

15 Laptops/ Wireless Network Providers, Wireless System 

Integrators, and Telephony providers wishing to become 
ISPs. The technology can also be integrated with other 
product lines to enhance projects that have strong ties 
to the WWW and have mobility components. 

2 0 will be appreciated tha^ ^e present invwbion 

is not limited to t:he exact construction or process 
steps that have been described above and illustrated In 
the accompanying drawings « and that various 
modifications and changes can be made without departing 

25 from the scope and spirit thereof. It is intended that 
tlie scope and spirit of the invention only be limit.ed by 
the appended claims. 
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mi TB g^liTMBP TBS 

1« A m^^od for cosuaunic&^lng witti a coaput:er 

n«^vor)c, comprising: 

placing a lios^ compu^ar having a brovsar and a 
S local proxy in a first location; 

placing a reaota proxy in a second location in 
communication witH said local proxy through a low- 
bandwidth networks- 
initiating a query on said browser and sending said 
10 query to said local proxy using an application layer 
protocol; 

converting said application layer protocol of said 
query into a transport protocol suitable for 
^transmission over said low-bandwidth network; 
IS transmitting said query over said low-bandwidth 

network from said local proxy to said remote proxy; and 

converting said transport protocol into an 
application layer protocol suitable for executing said 
query on said computer network. 

20 

2. The method according to claim 1, further 
comprising said steps of communicating said query to a 
network server ^ executing said G[uery, and returning a 
data object to said remote proxy. 

25 

3. The method according to claim 2, further 
comprising said steps of: 

converting said data object into a transport 
protocol suitable for transmission over said low- 
30 bandwidth network; 

transmitting said data object over said low- 
bandwidth natwork from said remote proxy to said local 
proxy; 

converting said transport protocol of said data 
35 object into an application layer protocol at said local 
proxy; and 
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coinaunicat:ln9 said dat;a obj^c^ in^o said browser 
using said applicat.ion layer protocol. 

4* Tbe metliod according ^o claim 1^ further 
5 conprising a startup operation comprising said stops of: 
starting said local proxy on said bost computer; 
configuring and starting said browser using said 
local proxy. 

5. The method according to claim 1, wherein said 
step of converting said application layer protocol of 
said qruery further comprises said steps of: 

creating a guery script having settings for 
compression^ filters, and encryption; and 

encapsulating said query script for transmission 
over said low-bandwidth network from said local proxy to 
said remote proxy* 



10 



15 



6. The method according to claim 5, wherein said 
20 step of converting said application layer protocol of 

said data object further comprises said steps of: 

compressing, filtering, and encrypting said data 
object according to said settings in said query script; 
and 

25 placing said data object in a reply script for 

transmission over said low-bandwldth network from said 
remote proxy to said local proxy. 

7. The method according to claim 6^ further 
30 cox^rising said steps of: 

matching said reply script with said query script 
upon receiving said reply script in said local proxy; 

delivering said reply script to said browser; 

unpackaging said data object from said reply 
35 script; and 

displaying said data object in a viewer of said 
browser « 
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8. The met:hod according t:o claim i, f\irt:littr 
compz-isin? said s^eps oti 

creating a service script: at said remote proxy; 

^ansini'tt:ing said service script from said remote 
5 proxy to said local proxy; 

parsing said service script and extracting a 
requested action and data object from said service 
script; and 

executing a service action at said local proxy* 

10 

9. The method according to claim X, wherein said 
computer network is the World wide Web. 



10* A system for communicating with a coi^uter 
15 network, comprising: 

a host computer having a browser and a local proxy 
in a ;f irst location; 

a remote proxy in a second location in 
communication with said local proxy through a low 
20 bandwidth network; 

means for initiating a qpiary on said browser and 
sending said query to said local proxy using an 
application layer protocol; 

means for converting said application layer 
25 protocol of said query into a transport protocol 
suitable for transmission over said low-bandwidth 
network; 

means for transmitting said query over said low- 
bandwidth network from said local proxy to said remote 
30 proxy; and 

means for converting said transport protocol into 
an application layer protocol suitable for execution of 
said qpaery on said computer network « 

3 5 11. The system according to claim 10, further 

comprising means for communicating said qpiery to a 
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network server, executing said query, and returning a 
data object to eaid remote proxy. 

12. The systeai according to claim 11, further 

5 comprising: 

means for converting said data object into a 
transport protocol suitable for transmission over said 
low-bandwidth network; 

means for transmitting said data object over said 
10 low-bandwidth network from said remote proxy to said 
local proxy; 

means for converting said transport protocol of 
said data object into an application layer protocol at 
said local proxy; and 
15 means for coxmunicating said data object into said 

browser using said application layer protocol. 

13. The system according to claim 10, further 
comprising: 

20 means for starting said local proxy on said host 

computer; 

means for configuring and staxrting said browser 
using said local proxy. 

25 14. The system according to claim 10, wherein said 

means for converting said application layer protocol of 

said query further comprises: 

nsuis for creating a query script having settings 

for compression, filters, and encryption; and 
30 means for encapsulating said query script for 

transmission over said low-bandwidth network from said 

local proxy to said remote proxy. 



35 



15. The system according to claim 14, wherein said 
means for converting said application layer protocol of 
said data object further comprises: 
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mmans for compraseing, filtering, and Micryp'bxng 
said da^ objac^ according ^o said saltings in said 
quary script:; and 

means for placing said da^a object in a reply 
5 script for t:ransBiission ovar said low-bandvidtti nat:wor)c 
from said ramo^a proxy to said local proxy. 



16. The system according to claim 15, fiorther 
comprising: 

10 means for matching said reply script vitb said 

query script upon receiving said reply script in said 
local proxy; 

means for delivering said reply script to said 
.browser; 

15 means for unpaOcaging said data object from said 

reply script; and 

means for displaying said data object in a viewer 
of said browser. 

20 17. The system according to claim 10, further 

comprising: 

means for creating a service script at said remote 
proxy; 

means for transmitting said service script from 
25 said remote proa^ to said local proxy; 

means for parsing said service script and 
extracting a requested action and data object from said 
service script; and 

means for executing a service action at said local 
3 0 proxy. 

18. The system according to claim 10, tiAerein said 
low-bandwidth network comprises a wireless networlc. 
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19. The system according to claim 10, wherein said 
computer network comprises the World Wide Web. 
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20. A syst:ui for coamunicatlng wltih a computier 
net;vor)c, comprislngs 

a hos^ conqputer having a browser for a user 
in^arf ace ; 

5 a local proxy means for comaxmica^ing witii said 

browser using an application layer protocols said local 
proxy means having means for converting said application 
layer protocol into a transport protocol; 

a remote proxy means for communicating with said 

10 local proxy means using said transport protocol, said 
remote proxy means having means for converting said 
transport protocol into said application layer protocol, 
said remote proxy means having means for communicating 
with said computer network using said application layer 

IS protocol. 

31. The system according to claim 20, wherein said 
local proxy and said remote proxy communicate through a 
low-beaidwidth network. 

20 

22 » The system according to claim 20, wherein said 
local proxy and said remote proxy cosnounieate through a 
wireless net;work. 

23. A secured cosqputer network int:erface 

comprising: 

a protected computer or compul^r network; 
a public computer network; 
a local proxy connecting said protected 
computer or conputier network and a conotKunication 

network; and 

a remote proxy connecting said conanunication 

network and said public computer network; 

wherein said proxies are provided with at 
least one encryption algorithm for encrypting data 
transmissions • 



25 
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24. A socured coi&puter net:vor)c intiexface as 

claims in olala 23, furtiher comprising a servica 

providar wIlo owns or mainline t:lie connact:lon ba^ween 

said communication network and said public computer 

5 network; wberein said at least one encryption algorithia 

is known to said service provider such that said sezrvice 

provider can access said protected computer or computer 

network. 



10 25. A sectored computer network interface as 

claimed in claim 24, wherein said service provider 
accesses said protected computer or computer network Cor 
the purpose of updating or configuring software on said 
protected computer or computer network. 

15 

26. A method for securing a computer network 
inte2;'face comprising the steps of: 

providing a con^uter or computer network to be 

protected; 

20 connecting said protected computer or computer 

network and a communication network with a local proxy; 

connecting said communication network and a 
public computer network with a remote proxy; and 

providing said proxies with at least one 
25 encryption algorithm for encrypting data transmissions • 

27. A method for securing a computer network 
interface as claimed in claim 26^ fxarther comprising the 
steps of : 

3 0 managing said connection between said 

communication network and said public coxsputer network; 

providing said at least one encryption 
algorithm to a service provider who manages said 
connection between said communication network and said 

35 public computer network. 
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28. A 6«c\ired computer network interface as 
claimed in claim 27, further comprising the step of 
accessing said protected computer or computer network 
using said at: leas^ one encryption algoritim so that 

5 said service provider can updaiie or configure software 
on said protected comput.er or computer network. 

29. A filtered computer network lnt:erface 
comprising ; 

10 a protected computer or computer network; 

a public coB^uter nelrwork; 

a local proxy connecting said protect:ed 
computer or coaD^uter network and a communicat:ion 
network; and 

15 a remote proxy connecting said communication 

network and said public cos^uter network; 

wherein said remote proxy filters data 
transmissions from said public coaster network to said 
protected computer or computer network* 

20 

30. A method for filtering data through a computer 
network interface cooprislng the steps of: 

providing a protected computer or cosgputer 

network; 

25 connecting said protected computer or computer 

network and a comnunication network with a local proxy; 

connecting said communication network and a 
public computer network with a remote proxy; and 

filtering data transmissions from said public 
30 cQ^uter network to said protected computer or computer 
network with said remote proxy. 

31. A computer network interface for compressing 
data comprising: 

35 a subscriber computer or computer network; 

a public computer network; 



wo 97/35402 PCT/US96/03909 

a local proxy connect:ing said subscriber 
compu^ar or conputisr net:vork and a communication 
ne^ork; and 

a r«ao^ proxy connacting said comsunica'tion 
5 nstvork and said public computer network; 

wherein said proxies compress data 
transmissions between said public conqputer network and 
said subscriber computer or computer network* 

10 32. A metbod for compressing data using a computer 

network interface comprising the steps o£: 

providing a subscriber computer or cosqputer 

network; 

. connecting said subscriber computer or 

15 computer network and a communication network with a 
local proxy; 

connecting said communication network and a 
public computer network with a remote proxy; and 

compressing data transmissions between said 
20 public cosiputer network and said subscriber computer or 
computer network with said proxies. 
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eiossay of Acxonyas 



CDPD Callul€ur Digi^l Padcat Dat» 

FIP File TransC«r Protocol 

5 HTHL Bypmr Tmxt Marfcup Language 

HTTP Byper Text: Transport Protocol 

XP Internet Protocol 

ZSDH integrated Services Digital Network 

XSG integrated Services Gatevay 

10 ISP Internet Service Providers 

LAN Local Area Network 

LP Local Proxy 

LZW Lev-Zeapel-Welch 

OS! Open Systeiis Interconnection 

15 PCI Personal CoBsunicatlons Intemetvork 

PDA Personal Digital Assistant 

RP Rnote Prmcy 

SMTP Sisple Katll Transfer Protocol 

SSL Secure Socket Laycur 

20 TCP Transmission Control Protocol 

UDP User Datagram Protocol 

ORL Universal Resource Locator 

WAIS Wide Area Information Search 

WWW World Wide Web 
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